Overview

overview

10

Static

static

da35a7f98e...50.exe

windows7_x64

10

da35a7f98e...50.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    da35a7f98eb07db60fa4365e5c704f50.exe
  • Size 998KB
  • Sample210224-eg4kec8ez2
  • SHA256 3926f922fe1ccafeb2bc3dea0332f8a3ec77ec2387a18e73fbbaafeec93bedab
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.peiyin.love/mjs/

Decoy

  • i-am-expressions.com

  • jvtnywveba.club

  • lifestorycards.com

  • vio-lence-official.com

  • themusicianchallenge.com

  • lebootenews.com

  • takcherry.com

  • offplannews.com

  • kdgdtools.com

  • 10best-hosting.com

  • glossyrag.com

  • mariettepottsphotography.com

  • lovelyeses.com

  • vualpe.com

  • moqshare.com

  • reikihealingcommunity.com

  • riverrockla.com

  • themaogroup.com

  • pachucosax.com

  • yogeshsuryavanshi.com

Targets

    • Target
      da35a7f98eb07db60fa4365e5c704f50.exe
    • Size 998KB
    • SHA256 3926f922fe1ccafeb2bc3dea0332f8a3ec77ec2387a18e73fbbaafeec93bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks